Security Concepts

Security Concepts
BSCI v3.0—2-1
Upon completion of the section, you should be able to:
• Describe the evolution of network security.
• Describe the various types of attack tools used by hackers.
• Describe malware.
• Explain common network attacks.

Drivers for Network Security
Common network security terms:
• Threat
• Vulnerability
• Mitigation
Cisco Security Intelligence Operations
• Risk
The Hacker & The Evolution of Hackers
Modern hacking titles:

• Script Kiddies
• Vulnerability Brokers
• Hacktivists
• Cyber Criminals
• State-Sponsored
Hackers
Evolution of Security Tools
Penetration testing tools:
• Password crackers • Forensic
• Wireless hacking • Debuggers
• Network scanning and • Hacking operating systems

hacking • Encryption
• Packet crafting
• Vulnerability exploitation
• Packet sniffers
• Vulnerability Scanners
• Rootkit detectors
• Fuzzers to search
vulnerabilities
Categories of Attack Tools
Network hacking attacks:
• Eavesdropping
• Data modification
• IP address spoofing
• Password-based
• Denial-of-service
• Man-in-the-middle
• Compromised-key
• Sniffer
Viruses
Trojan Horse Classification
Classifications:
• Security software disabler
• Remote-access
• Data-sending
• Destructive
• Proxy
• FTP
• DoS
Worms
Initial Code Red Worm Infection
Code Red Worm Infection 19 Hours

Later
Worm Components
Components:
1.
Propagate
• Enabling vulnerability for 19 days
• Propagation
mechanism
• Payload 4.
Code Red 2.
Launch DoS
Repeat the
cycle
Worm attack for
next 7 days
Propagation
3.
Stop and go
dormant for
a few days
Other Malware
Ransomware Scareware
Spyware Phishing
Adware Rootkits
Types of Network Attacks
Data
Modification
Syn Flood
Smurf
Attack
Reconnaissance
Access
DoS
Reconnaissance Attacks
• Initial query of a target
• Ping sweep of the target network
• Port scan of active IP addresses
• Vulnerability scanners
• Exploitation tools
Access Attacks
A few reasons why hackers use access attacks:
• To retrieve data
• To gain access
• To escalate access privileges
A few types of access attacks include:

• Password
• Trust exploitation
• Port redirection
• Man-in-the-middle
• Buffer overflow
• IP, MAC, DHCP spoofing

Social Engineering Attacks
• Pretexting
• Phishing
• Spearphishing
• Spam
• Tailgating
• Something for Something
• Baiting
Denial of Service Attacks
DDoS Attacks
1. Hacker builds a network of infected machines
• A network of infected hosts is called a botnet.
• The compromised computers are called zombies.
• Zombies are controlled by handler systems.
2. Zombie computers continue to scan and

infect more targets
3. Hacker instructs handler system to make the
botnet of zombies carry out the DDoS attack
Upon completion of this section, you should be able to:
• Describe methods and resources to protect the networks.
• Describe a collection of domains for network security.
• Explain the purpose of the Cisco SecureX Architecture.
• Describe the techniques used to mitigate common network attacks.
• Explain how to secure the three functional areas of Cisco routers and
switches.
Confidentiality, Integrity, Availability
Confidentiality:
Uses encryption to
encrypt and hide
data.
Components
of
Cryptography
Availability:
Integrity:
Assures data is
Uses hashing
accessible.
algorithms to
Guaranteed by
ensure data is
network hardening
unaltered during
mechanisms and
operation.
backup systems.
Network Security Domains
• Risk assessment
• Security policy
• Organization of information security
• Asset management
• Human resources security
• Physical and environmental security
• Communications and operations management
• Information systems acquisition, development, and maintenance
• Access control
• Information security incident management
• Business continuity management
• Compliance
Network Security Policy
Network Security Policy Objectives
Defending the Network
Best practices:
• Develop a written security policy.
• Educate employees about the risks of social engineering, and develop

strategies to validate identities over the phone, via email, or in person.
• Control physical access to systems.
• Use strong passwords and change them often.
• Encrypt and password-protect sensitive data.
• Implement security hardware and software.
• Perform backups and test the backed up files on a regular basis.
• Shut down unnecessary services and ports.
• Keep patches up-to-date by installing them weekly or daily to prevent

buffer overflow and privilege escalation attacks.
• Perform security audits to test the network.
Mitigating Malware
Mitigating Worms
Containment
Inoculation Quarantine
Treatment
Mitigating Reconnaissance Attacks
Mitigating Access Attacks
Mitigating DoS Attacks
Upon completion of this section, you should be able to:
• Secure Access in Network Infrastructure
• Configure administrative privilege levels to control command availability

Securing the Network Infrastructure
Three Areas of Router Security
Secure Administrative Access
Tasks:
• Restrict device accessibility
• Log and account for all access
• Authenticate access
• Authorize actions
• Present legal notification
• Ensure the confidentiality of data

Secure Local and Remote Access
Local Access Remote Access Using Telnet
Remote Access Using Modem and Aux Port

Strong Passwords
Guidelines:
• Use a password length of 10 or more characters.
• Include a mix of uppercase and lowercase letters, numbers, symbols, and spaces.
• Avoid passwords based on easily identifiable pieces of information.
• Deliberately misspell a password (Smith = Smyth = 5mYth).
• Change passwords often.
• Do not write passwords down and leave them in obvious places.

Weak Password Why it is Weak Strong Password Why it is Strong
secret Simple dictionary password b67n42d39c Combines alphanumeric characters
smith Mother’s maiden name 12^h u4@1p7 Combines alphanumeric characters,

symbols, and includes a space
toyota Make of car
bob1967 Name and birthday of user
Blueleaf23 Simple words and numbers

Increasing Access Security
Secret Password Algorithms
Guidelines:
• Configure all secret passwords using type 8 or type 9 passwords
• Use the enable algorithm-type command syntax to enter an unencrypted

password
• Use the username name algorithm-type command to specify type 9

encryption
Securing Line Access
Limiting Command Availability
Privilege levels: Levels of access commands:
• Level 0: Predefined for user-level access privileges. User EXEC mode (privilege level 1)
• Lowest EXEC mode user privileges
• Level 1: Default level for login with the router prompt. • Only user-level command available at the router>
prompt
• Level 2-14: May be customized for user-level
Privileged EXEC mode (privilege level 15)
privileges.
• All enable-level commands at the router# prompt
• Level 15: Reserved for the enable mode privileges.
Privilege Level Syntax

Limitations of Privilege Levels
No access control to specific interfaces, ports, logical interfaces,
and slots on a router
Commands available at lower privilege levels are always executable
at higher privilege levels
Commands specifically set at higher privilege levels are not
available for lower privilege users
Assigning a command with multiple keywords allows access to all
commands that use those
© 2013 Cisco and/or its affiliates. All rights reserved. Cisco Public 40

Security Concepts

Uploaded by

Copyright:

Available Formats

Security Concepts

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Security Concepts

Uploaded by

Copyright:

Available Formats

Security Concepts

• Describe the various types of attack tools used by hackers.

• Explain common network attacks.

Modern hacking titles:

• Wireless hacking • Debuggers

• Network scanning and • Hacking operating systems

Initial Code Red Worm Infection

Code Red Worm Infection 19 Hours

• Ping sweep of the target network

• Port scan of active IP addresses

• To escalate access privileges

A few types of access attacks include:

• IP, MAC, DHCP spoofing

• Something for Something

2. Zombie computers continue to scan and

• Describe a collection of domains for network security.

• Explain the purpose of the Cisco SecureX Architecture.

• Describe the techniques used to mitigate common network attacks.

• Organization of information security

• Human resources security

• Physical and environmental security

• Communications and operations management

• Information systems acquisition, development, and maintenance

• Information security incident management

• Business continuity management

• Educate employees about the risks of social engineering, and develop

• Use strong passwords and change them often.

• Encrypt and password-protect sensitive data.

• Implement security hardware and software.

• Perform backups and test the backed up files on a regular basis.

• Shut down unnecessary services and ports.

• Keep patches up-to-date by installing them weekly or daily to prevent

• Configure administrative privilege levels to control command availability

• Log and account for all access

• Present legal notification

• Ensure the confidentiality of data

Local Access Remote Access Using Telnet

Remote Access Using Modem and Aux Port

• Avoid passwords based on easily identifiable pieces of information.

• Deliberately misspell a password (Smith = Smyth = 5mYth).

• Change passwords often.

• Do not write passwords down and leave them in obvious places.

secret Simple dictionary password b67n42d39c Combines alphanumeric characters

smith Mother’s maiden name 12^h u4@1p7 Combines alphanumeric characters,

bob1967 Name and birthday of user

Blueleaf23 Simple words and numbers

• Use the enable algorithm-type command syntax to enter an unencrypted

• Use the username name algorithm-type command to specify type 9

Privilege Level Syntax

You might also like